strapi-plugin-plsresh-meeb@3.6.8: Malicious npm security report

OSV Malicious Advisory

imported 25d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16181 confirms this npm version as malicious. The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and binds an interactive shell to that socket, granting whoever operates that endpoint full interactive command execution on the installer's host. Execution is automatic on `npm install` via scripts.postinstall, requires no user action, and also writes a marker file under...

Advisory

MAL-2026-16181

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strapi-plugin-plsresh-meeb (npm)

Details

The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and binds an interactive shell to that socket, granting whoever operates that endpoint full interactive command execution on the installer's host. Execution is automatic on `npm install` via scripts.postinstall, requires no user action, and also writes a marker file under /tmp to confirm the callback. The package's own description self-labels as a reverse shell payload for Strapi.

Decision reason

OpenSSF Malicious Packages via OSV confirms strapi-plugin-plsresh-meeb@3.6.8 as malicious (MAL-2026-16181): Malicious code in strapi-plugin-plsresh-meeb (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

strapi-plugin-plsresh-meeb@3.6.8

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code